CVE-2026-54569: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in senaite senaite.core

SENAITE.CORE, the core framework for the SENAITE laboratory information management system, contains an unauthenticated remote code execution vulnerability in its JSON API for versions 2.0.0 to 2.6.0. Several state-changing routes in src/bika/lims/jsonapi/update.py do not enforce the required 'senaite.core: Access JSON API' permission before resolving objects selected by the attacker. Additionally, in src/bika/lims/jsonapi/init.py, raw request values for RecordsField and RecordField instances are passed directly to Python's eval() function before write-permission checks occur. This unsafe evaluation allows an anonymous attacker to execute arbitrary Python code in the Zope worker process by discovering object identifiers and sending crafted requests. Similar unsafe eval patterns exist in other source files. Exploitation can lead to full compromise of laboratory data integrity, confidentiality, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary Python code remotely within the Zope worker process. This can lead to exposure or modification of sensitive laboratory data, files, and user accounts, as well as disruption of the laboratory information management service. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical impact with network attack vector, no required privileges or user interaction, and high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the JSON API endpoints and monitor for suspicious activity. Avoid exposing the vulnerable API to untrusted networks. Review and harden permission checks on JSON API routes and eliminate unsafe use of eval() on user input.